Kubernetes profiling, enabled by default in the API server, scheduler, controller-manager, etc., can pose a security risk if not properly managed.

While the information is gated behind authz & authn, certain clusters can still be vulnerable to attacks.

More:

This week's 6 best Kubernetes vacancies that focus on security are:

DevSecOps Engineer with Worldcoin
💰 $236K to $323K a year
🏠 From the office in San Francisco, CA, USA
→

DevSecOps Engineer with Gemini
💰 $248K to $310K a year
👨‍💻 Remote from the United States
→

DevSecOps Engineer with Uniswap Labs
💰 $264K to $294K a year
🏠 From the office in New York, NY, USA
→

DevSecOps Engineer with CoreWeave
💰 $240K to $275K a year
🏠🏃🏻‍♂️🌎 Roseland, NJ / Brooklyn, NY / Sunnyvale, CA / Bellevue, WA, USA
→

👉 Browse all 1302 Kubernetes jobs on Kube Careers

This tutorial demonstrates how to set up a zero-trust Kubernetes ingress with Tailscale operator, cert-manager, and external-dns.

The configuration enables easy and rapid deployment of private ingresses accessible only to authorized devices.

More:

This week on the Learn Kubernetes Weekly:

🚉 How we are managing a container platform
💧 Leaky Vessels deep dive: escaping from Docker one syscall at a time
🕵️‍♀️ How to inspect Kubernetes networking
🔧 Removing specific images from all Kubernetes nodes
🌎 Kubernetes resiliency (RTO/RPO) in multi-cluster deployments

Read it now:

🙏 Many thanks to StormForgeIO for supporting our work and sponsoring this issue. Make sure to check out their platform to optimise resources and save on your cloud spend

The "TunnelVision" attacks reinforce the need for a new security paradigm.

In this article, you will explore how this type of attack can be mitigated in the future and what tools you need.

More:

In this KubeFM episode, Hans, a Principal Cloud engineer, shares his experiences empowering teams to use, build and manage platforms built on Kubernetes.

You will learn:

- How OpenTelemetry and Prometheus shape cluster management and observability.
- The role of tools like ArgoCD and Flux in enabling GitOps and streamlining deployment processes.
- The significance of governance tools such as Gatekeeper and OPA for secure and validated resource creation.
- The benefits of Custom Resource Definitions (CRDs) and operators in automating processes and enhancing the developer experience.

Watch (or listen to) it here:

🙏 Many thanks to Sysdig for supporting our work and sponsoring this episode. Make sure to check out their Kubernetes security checklist

With "Zero certified" Farrell

In this article, you will learn about Istio AuthorizationPolicies and how they function, as well as use an alternative approach to declare them using IBAC (Intent-Based Access Control)

More:

Ben Hirschberg, ARMO's CTO, discusses managing network policies at scale By monitoring development and staging clusters and analyzing application behaviour.

This automated process ensures robust network segmentation, closely aligning with zero-trust principles.

Watch the full interview:

This interview is a reaction to Ori's episode

The article discusses automating the building, signing, and verifying of Docker images using tools like Kaniko, Cosign, and Kyverno.

It explains how these tools can be integrated into a GitLab CI/CD pipeline to improve efficiency and security.

More:

This week's 6 best Kubernetes vacancies that focus on security are:

DevSecOps Engineer with Applied Intuition
💰 $65K to $400K a year
🏠 From the office in Mountain View, CA, USA
→

DevSecOps Engineer with Hyperscience
💰 $190K to $260K a year
👨‍💻 Remote from the United States
→

DevSecOps Engineer with Crusoe
💰 $210K to $240K a year
🏠 From the office in San Francisco, CA, USA
→

DevSecOps Engineer with Opal Security
💰 $140K to $260K a year
🏠🏃🏻‍♂️🌎 San Francisco, CA / New York, NY, USA
→

DevSecOps Engineer with iHerb
💰 $162.19K to $221.17K a year
🏠 From the office in Irvine, CA, USA
→

👉 Browse all 442 Kubernetes jobs on Kube Careers

Learn how Snyk security researchers uncovered the Leaky Vessels container breakout Docker vulnerabilities that allow a malicious attacker to break out of a container environment with a controlled Dockerfile under docker build and docker run.

More:

This week on the Learn Kubernetes Weekly:

🥷 Kubernetes webhook used by attackers
👨🏻‍💼 When is admin not admin? When it's super-admin!
📆 Kubernetes HPA based on events in Google Calendar
🔀 Seamless data exchange with Kafka Connect and Strimzi on Kubernetes at Decathlon
🛑 Database in Kubernetes: is that a good idea?

Read it now:

🙏 Many thanks to Otterize for supporting our work and sponsoring this issue. Make sure to check out their intent-based access control platform (and related open-source projects)

This week's 6 best Kubernetes vacancies that focus on security are:

DevSecOps Engineer with Anthropic
💰 $300K to $405K a year
🏠🏃🏻‍♂️🌎 San Francisco, CA / New York, NY, USA
→

DevSecOps Engineer with Plaid
💰 $215.3K to $322.9K a year
👨‍💻 Remote from the United States
→

DevSecOps Engineer with Applied Intuition
💰 $65K to $400K a year
🏠 From the office in Mountain View, CA, USA
→

DevSecOps Engineer with Hyperscience
💰 $190K to $260K a year
👨‍💻 Remote from the United States
→

DevSecOps Engineer with Crusoe
💰 $210K to $240K a year
🏠 From the office in San Francisco, CA, USA
→

👉 Browse all 447 Kubernetes jobs on Kube Careers

Container image hardening involves adhering to best practices, monitoring vulnerabilities, and enhancing container security.

This article provides guidelines to mitigate risks in running Docker containers in production.

More:

This week on the Learn Kubernetes Weekly:

👆 Moving up the stack
✂️ Cut container startup time
😈 Abusing Distroless
🥷 Hacking Kubernetes in AWS
🤔 2vCPU app run faster in a VM than in a container

Read it now:

KBOM (Kubernetes Bill of Materials) is a CLI tool that can generate a software bill of materials for your Kubernetes cluster.

More:

In this KubeFM episode, Alexander Block delves into the intricacies of Kubernetes templating and deployment tools, sharing his journey from frustration with existing solutions to creating his tool, kluctl.

Alex also discusses the challenges and solutions in Kubernetes templating and deployment, emphasizing the need for more adaptable tools in the Kubernetes ecosystem.

You will learn:

- The fundamental flaws of Helm and how they impact Kubernetes deployments and tools packaging.
- How tools such as Kustomize, CUE, jsonnet are only a partial solution to templating.
- Alternatives to Helm and the future of Kubernetes resource templating and distribution.

Watch (or listen to) it here:

This article teaches how to use the Secrets Store CSI driver to mount secrets to Kubernetes pods and covers how to configure and simulate the CSI driver failover feature.

More:

In this article, you'll learn how to secure EKS by intentionally attaching the wrong policies to pods and hacking the cluster.

You will misconfigure AWS Identity and Access Management (IAM) roles for the service accounts (IRSA) feature.

More:

This article argues, and demonstrates that Distroless containers are not immune to unconventional hacking methods just because shell programs aren't included in the image.

More: